Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Regulation October 8, 2026 8 min

A dismissal decided by the algorithm is void: from 23 October in Italy

Italian legislative decree no. 179 of 7 October 2026 brings artificial intelligence into the employment relationship and into the workplace risk assessment. The penalty for getting it wrong is not a fine: it is that the act produces no effect

What was published, and from when it applies

Legislative decree no. 179 of 7 October 2026 was published in Official Gazette no. 234 of 8 October 2026 and entered into force on 23 October 2026. It covers several areas; on employment the two articles that matter are Article 41, on automated decisions in the employment relationship, and Article 42, which brings artificial intelligence systems into the risk assessment under Article 28 of decree 81/2008 and requires specific information and training. The prior notice remains the one under Article 1-bis of decree 152/1997.

The part that really changes the job is one line. Article 41 states that final decisions on the employment relationship cannot be based solely on automated processing, that the worker is entitled, on request, to an understandable explanation of the decision, and at paragraph 4 that decisions taken in breach of these rules are void. Not «voidable on appeal»: void. A dismissal, a non-renewal, a change of duties decided by the system alone produce no effect, and that holds regardless of how good the model is and how large the administrative fine might be.

It is worth pausing on the word «solely», because everything turns on it and because it is the same word as in Article 22 GDPR, with ten years of argument behind it. An HR manager who receives a ranking generated by the system, has no way of contesting it, does not know the criteria and signs off what the system proposes, is not human intervention: that is a signature. The intervention that takes the decision outside the rule is by someone with the authority and the information to change it, and who sometimes actually changes it.

  • It applies to FINAL decisions on the relationship: hiring, modification, termination. An automated filter upstream of a real interview is a different thing, but it still has to be declared.
  • The explanation must be given on request and must be understandable: «the system assigned a score of 42» is not an explanation, it is a number.
  • The notice under Article 1-bis of decree 152/1997 must be given BEFORE the processing starts, and covers decision-making and monitoring systems too.
  • AI systems affecting work organisation, production rhythms or how work is performed go into the risk assessment, not into a separate annex.
  • Workers need information and training on the specific risks of those systems and on the measures adopted.

AI in the risk assessment is not one more chapter

On this point commentators disagree, and it is worth knowing before advising a client. Some hold that adding an artificial intelligence chapter to the risk assessment document is enough; others argue a broader revision is needed. The second view holds up better, for a practical reason: a generic AI annex, disconnected from the assessments already made on work-related stress, ergonomics and machinery risk, describes a system that does not exist in the rest of the document. An inspector comparing the two parts finds a document talking to itself. On the other hand not every new application automatically requires a formal update: the test is whether it affects organisation, rhythms or safety, not whether it contains a model.

The Italian picture adds to what the data protection authority had already said. In a decision of 14 May 2026 the authority addressed artificial intelligence systems in the workplace, in particular tools that analyse workers' emotional or psychological aspects, with a principle that is simple to state and uncomfortable to apply: the employer must not come to know, even indirectly, information about the emotional or psychological sphere of those who work for them. A system measuring tone of voice on a customer service call, or posture in front of a camera, falls inside it even when the vendor calls it «quality analysis».

For a DPO there are three things to ask the client, and the first is often disarming. Which systems already in the building produce a score, a ranking or an alert about a person? Almost always the first answer is «none», and almost always what then surfaces is the shift-scheduling software, the warehouse productivity tool, the CV filter in the recruitment portal. None of these was bought as «artificial intelligence», and that is exactly why they are not in the register.

The other two are quicker. Who signs the final decision, and do they genuinely have the power to depart from the suggestion? And what is said to the worker who asks why. It is worth writing that answer before anyone asks for it: a text prepared calmly, with the criteria and the weight of each, is a compliance document; the same text written in a hurry after a complaint is a justification, and it shows.

Official source:Gazzetta Ufficiale — decree no. 179 of 7 October 2026 (OG no. 234 of 8 October 2026)Official source:PuntoSicuro — AI Act and decree 179/2026: impact and duties for occupational safetyOfficial source:Garante per la protezione dei dati personali — decisions

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min
Regulation
4weeks: the shortest period in Europe

Four weeks, not a day more: how long applicant data may be kept in the Netherlands

Four weeks after the procedure ends is the shortest retention period in Europe for this data, and it is not optional guidance: faced with a complaint it is the first thing the Dutch authority checks. The copy of the identity document is the exception that splits the personnel file in three.

Sep 18, 2026 6 min